Before starting a user representation, the system checks whether the current representer is allowed to represent a particular user. In order to perform the necessary authorization, the system calls a plugin that implements the Java interface RepresentationAuthorization
.
- Currently, two different plugins that implement this interface are available in the product:
- Allow All Representation Authorization – this plugin doesn't do any authorization and always returns
true
. - Role Based Representation Authorization – this plugin checks whether the representer has at least one of the required roles, which can be configured in this plugin.
Companies that use the representation feature can implement their own authorization scheme. For example, if a bank's policy requires that only a customer's personal service consultant can represent that particular customer, the bank could implement a RepresentationAuthorization
plugin that calls a service in one of the bank's servers that checks whether the representee is assigned as personal service consultant to the selected customer.
If the representer is not authorized to represent the desired user, a representation denied page is shown explaining the reason.